Medium SeverityDMARC

Fix: DMARC Subdomain Policy Not Set

Your DMARC record does not include an sp= tag to define policy for subdomains. Without it, subdomains inherit the parent domain's policy, which may not be appropriate.

Quick Fix

Add `sp=reject` to your DMARC record to protect subdomains.

What This Error Means

The sp= tag sets the policy specifically for subdomains. Without it, subdomains inherit the p= tag policy. If your p= is "none" for monitoring, all subdomains are also unprotected.

Why It Matters

Attackers often target subdomains for spoofing because they are less likely to have their own email authentication. Setting sp=reject protects unused subdomains from being spoofed.

Step-by-Step Fix

Check your current DMARC policy

See what your current policy is and whether sp= is already set.

Example

dig +short TXT _dmarc.yourdomain.com

Add the sp= tag

Add a subdomain policy to your DMARC record.

Before

v=DMARC1; p=quarantine; rua=mailto:[email protected]

After

v=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected]

Verify subdomain coverage

Confirm the updated record is published and test with a subdomain.

Example

dig +short TXT _dmarc.yourdomain.com
# The sp=reject tag should be visible

Common Gotchas

If you have subdomains that legitimately send email (e.g., marketing.yourdomain.com), make sure they have proper SPF and DKIM before setting sp=reject.
A subdomain can have its own DMARC record at _dmarc.subdomain.yourdomain.com, which overrides the parent's sp= policy.
Without sp=, the subdomain policy defaults to the p= value. The sp= tag is most important when p=none or p=quarantine.

Verify Your Fix

After making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.

Frequently Asked Questions

What does sp=reject do?

The sp=reject tag tells receiving servers to reject any email from your subdomains that fails DMARC authentication, even if the main domain has a more relaxed policy.

Do I need sp= if my main policy is already reject?

Not strictly, since subdomains inherit the p= policy when sp= is not set. But explicitly setting sp=reject is good practice for clarity.

Can a subdomain override the parent DMARC policy?

Yes. A subdomain can have its own DMARC record at _dmarc.subdomain.yourdomain.com, which overrides both p= and sp= from the parent domain.